Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

PrivSpike: Employing Homomorphic Encryption for Private Inference of Deep Spiking Neural Networks

Nges Brian Njungle, Eric Jahns, Milan Stojkov, Michel A. Kinsy

TL;DR

PrivSpike presents a CKKS-based framework for private inference in deep Spiking Neural Networks, addressing the non-linear LIF activation with two encrypted-domain approaches: a Chebyshev polynomial approximation and a scheme-switching method that leverages TFHE for high-precision comparisons. The system implements encrypted versions of input, convolution, pooling, and fully connected layers, along with an efficient output-decoding mechanism, enabling scalable private inference across standard and neuromorphic datasets (MNIST, N-MNIST, CIFAR-10, CIFAR-10 DVS) using LeNet-5 and ResNet-19. Empirical results show encrypted accuracy closely tracking plaintext in scheme-switching (e.g., MNIST 98.10% vs 98.90% plaintext on LeNet-5; CIFAR-10 DVS 66.0% vs 68.10% plaintext on ResNet-19), with latency and memory trade-offs that favor the polynomial-approximation approach for general use and scheme-switching when precision is crucial. PrivSpike achieves substantial speedups over prior encrypted SNN solutions (e.g., ~34x faster than Farzad et al. and ~50x faster than FHE-DiCNN on LeNet-5 MNIST) while maintaining strong cryptographic privacy guarantees, highlighting the practical viability of energy-efficient SNNs in privacy-sensitive applications.

Abstract

Deep learning has become a cornerstone of modern machine learning. It relies heavily on vast datasets and significant computational resources for high performance. This data often contains sensitive information, making privacy a major concern in deep learning. Spiking Neural Networks (SNNs) have emerged as an energy-efficient alternative to conventional deep learning approaches. Nevertheless, SNNs still depend on large volumes of data, inheriting all the privacy challenges of deep learning. Homomorphic encryption addresses this challenge by allowing computations to be performed on encrypted data, ensuring data confidentiality throughout the entire processing pipeline. In this paper, we introduce PRIVSPIKE, a privacy-preserving inference framework for SNNs using the CKKS homomorphic encryption scheme. PRIVSPIKE supports arbitrary depth SNNs and introduces two key algorithms for evaluating the Leaky Integrate-and-Fire activation function: (1) a polynomial approximation algorithm designed for high-performance SNN inference, and (2) a novel scheme-switching algorithm that optimizes precision at a higher computational cost. We evaluate PRIVSPIKE on MNIST, CIFAR-10, Neuromorphic MNIST, and CIFAR-10 DVS using models from LeNet-5 and ResNet-19 architectures, achieving encrypted inference accuracies of 98.10%, 79.3%, 98.1%, and 66.0%, respectively. On a consumer-grade CPU, SNN LeNet-5 models achieved inference times of 28 seconds on MNIST and 212 seconds on Neuromorphic MNIST. For SNN ResNet-19 models, inference took 784 seconds on CIFAR-10 and 1846 seconds on CIFAR-10 DVS. These results establish PRIVSPIKE as a viable and efficient solution for secure SNN inference, bridging the gap between energy-efficient deep neural networks and strong cryptographic privacy guarantees while outperforming prior encrypted SNN solutions.

PrivSpike: Employing Homomorphic Encryption for Private Inference of Deep Spiking Neural Networks

TL;DR

PrivSpike presents a CKKS-based framework for private inference in deep Spiking Neural Networks, addressing the non-linear LIF activation with two encrypted-domain approaches: a Chebyshev polynomial approximation and a scheme-switching method that leverages TFHE for high-precision comparisons. The system implements encrypted versions of input, convolution, pooling, and fully connected layers, along with an efficient output-decoding mechanism, enabling scalable private inference across standard and neuromorphic datasets (MNIST, N-MNIST, CIFAR-10, CIFAR-10 DVS) using LeNet-5 and ResNet-19. Empirical results show encrypted accuracy closely tracking plaintext in scheme-switching (e.g., MNIST 98.10% vs 98.90% plaintext on LeNet-5; CIFAR-10 DVS 66.0% vs 68.10% plaintext on ResNet-19), with latency and memory trade-offs that favor the polynomial-approximation approach for general use and scheme-switching when precision is crucial. PrivSpike achieves substantial speedups over prior encrypted SNN solutions (e.g., ~34x faster than Farzad et al. and ~50x faster than FHE-DiCNN on LeNet-5 MNIST) while maintaining strong cryptographic privacy guarantees, highlighting the practical viability of energy-efficient SNNs in privacy-sensitive applications.

Abstract

Deep learning has become a cornerstone of modern machine learning. It relies heavily on vast datasets and significant computational resources for high performance. This data often contains sensitive information, making privacy a major concern in deep learning. Spiking Neural Networks (SNNs) have emerged as an energy-efficient alternative to conventional deep learning approaches. Nevertheless, SNNs still depend on large volumes of data, inheriting all the privacy challenges of deep learning. Homomorphic encryption addresses this challenge by allowing computations to be performed on encrypted data, ensuring data confidentiality throughout the entire processing pipeline. In this paper, we introduce PRIVSPIKE, a privacy-preserving inference framework for SNNs using the CKKS homomorphic encryption scheme. PRIVSPIKE supports arbitrary depth SNNs and introduces two key algorithms for evaluating the Leaky Integrate-and-Fire activation function: (1) a polynomial approximation algorithm designed for high-performance SNN inference, and (2) a novel scheme-switching algorithm that optimizes precision at a higher computational cost. We evaluate PRIVSPIKE on MNIST, CIFAR-10, Neuromorphic MNIST, and CIFAR-10 DVS using models from LeNet-5 and ResNet-19 architectures, achieving encrypted inference accuracies of 98.10%, 79.3%, 98.1%, and 66.0%, respectively. On a consumer-grade CPU, SNN LeNet-5 models achieved inference times of 28 seconds on MNIST and 212 seconds on Neuromorphic MNIST. For SNN ResNet-19 models, inference took 784 seconds on CIFAR-10 and 1846 seconds on CIFAR-10 DVS. These results establish PRIVSPIKE as a viable and efficient solution for secure SNN inference, bridging the gap between energy-efficient deep neural networks and strong cryptographic privacy guarantees while outperforming prior encrypted SNN solutions.

Paper Structure

This paper contains 35 sections, 9 equations, 5 figures, 4 tables, 3 algorithms.

Table of Contents

  1. Introduction
  2. Related Works
  3. Background
  4. Homomorphic Encryption
  5. Cheon-Kim-Kim-Song (CKKS) scheme
  6. Spiking Neural Networks (SNNs)
  7. Secure Spiking Neural Network Layers
  8. Input Layer
  9. Convolution Layer
  10. Average Pooling
  11. Fully Connected Layer
  12. Leaky-Integrate and Fire (LIF) Layer
  13. Polynomial Approximation of the LIF Function
  14. Scheme-Switching Evaluation of LIF Function
  15. Output Decoding Layer
  16. ...and 20 more sections

Figures (5)

  • Figure 1: A HE outsourced cloud computation scenario showing a user who encrypts data and evaluates a function in the cloud. The encrypted results are sent back to the user, who decrypts them to get the evaluated results.
  • Figure 2: Overview of a spiking neural network. Spikes are input across discrete time steps and propagated through linear and non-linear layers. Linear layers extract spatial features, while non-linear spiking dynamics capture temporal dependencies via recurrent processing. The output layer accumulates spikes over time and decodes them into a prediction.
  • Figure 3: Rotated Ciphertexts for convolution. The number of rotations is a total of $k^2-1$ where $k$ is the kernel width.
  • Figure 4: Vector Encoding Convolution: The repeated kernel values are multiplied with equivalent rotated ciphertexts and summed to produce results.
  • Figure 5: Vector Encoding Secure Average Pooling: These rotations are then summed and multiplied by $1/k^2$